Skip to content
Noroxi

CWE-347 · 799 records

Improper verification of cryptographic signature

Why does it happen?

The verifier takes the algorithm to verify with from the token’s own header. Untrusted data ends up deciding its own verification rule.

Vulnerable and fixed code

A representative teaching example. Highlighted lines mark where the bug and the fix are.

Vulnerable

ts
const claims = jwt.verify(token, publicKey);

Fixed

ts
const claims = jwt.verify(token, publicKey, {  algorithms: ["RS256"],  issuer: "https://id.example.com",  audience: "portal",});

How to prevent it

  1. 01Pin the accepted algorithm on the server.
  2. 02Always validate the issuer (iss), audience (aud) and expiry (exp) claims.
  3. 03Don’t mix asymmetric and symmetric verification families on the same endpoint.

CVEs in this class

800 records

  • CVE-2025-59718
    89Now

    A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, Forti

    CriticalCVSS 9.8KEVWeaponizedEPSS 68%

    fortinet · fortiproxyDec 9, 2025

  • CVE-2020-1464
    73This week

    Windows Spoofing Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 39%

    microsoft · windows 10 1507Aug 17, 2020

  • CVE-2020-2021
    71This week

    PAN-OS: Authentication Bypass in SAML Authentication

    CriticalCVSS 10.0KEVWeaponizedEPSS 4%

    paloaltonetworks · pan-osJun 29, 2020

  • CVE-2026-48558
    70This week

    SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification

    CriticalCVSS 9.5KEVWeaponizedEPSS 6%

    simple-help · simplehelpJun 12, 2026

  • CVE-2026-5430
    70This week

    Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover

    CriticalCVSS 10.0KEVWeaponizedEPSS 1%

    wso2 · api control planeAug 6, 2026

  • CVE-2013-3900
    65This week

    WinVerifyTrust Signature Validation Vulnerability

    MediumCVSS 5.5KEVWeaponizedEPSS 45%

    microsoft · windows 10 1507Dec 10, 2013

  • CVE-2025-25292
    57Plan

    Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential)

    CriticalCVSS 9.3No exploitEPSS 65%

    omniauth · omniauth samlMar 12, 2025

  • CVE-2021-22160
    55Plan

    Authentication with JWT allows use of “none”-algorithm

    CriticalCVSS 9.8No exploitEPSS 53%

    apache · pulsarMay 26, 2021

  • CVE-2018-16042
    51Plan

    Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and ear

    MediumCVSS 6.5No exploitEPSS 82%

    adobe · acrobat dcJan 18, 2019

  • CVE-2025-47827
    49Plan

    In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature.

    MediumCVSS 4.6KEVWeaponizedEPSS 5%

    igel · igel osJun 5, 2025

  • CVE-2025-59719
    48Plan

    An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 t

    CriticalCVSS 9.8No exploitEPSS 29%

    fortinet · fortiwebDec 9, 2025

  • CVE-2024-9487
    46Plan

    An Improper Verification of Cryptographic Signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed

    CriticalCVSS 9.5Proof of conceptEPSS 26%

    github · enterprise serverOct 10, 2024

  • CVE-2018-0114
    43Plan

    A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens u

    HighCVSS 7.5Proof of conceptEPSS 43%

    cisco · node-joseJan 4, 2018

  • CVE-2025-25291
    43Plan

    ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)

    CriticalCVSS 9.3Proof of conceptEPSS 21%

    omniauth · omniauth samlMar 12, 2025

  • CVE-2024-45409
    42Plan

    The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector

    CriticalCVSS 9.8Proof of conceptEPSS 11%

    onelogin · ruby-samlSep 10, 2024

  • CVE-2021-37160
    41Plan

    A firmware validation issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of softwar

    CriticalCVSS 9.8No exploitEPSS 8%

    swisslog-healthcare · hmi-3 control panel firmwareAug 2, 2021

  • CVE-2021-33885
    41Plan

    An Insufficient Verification of Data Authenticity vulnerability in B.

    CriticalCVSS 9.8No exploitEPSS 6%

    bbraun · spacecom2Aug 25, 2021

  • CVE-2025-29775
    40Plan

    xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment

    CriticalCVSS 9.3Proof of conceptEPSS 10%

    node-saml · xml-cryptoMar 14, 2025

  • CVE-2025-29774
    40Plan

    xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References

    CriticalCVSS 9.3Proof of conceptEPSS 9%

    node-saml · xml-cryptoMar 14, 2025

  • CVE-2018-12356
    40Plan

    An issue was discovered in password-store.sh in pass in Simple Password Store 1.7.x before 1.7.2.

    CriticalCVSS 9.8No exploitEPSS 5%

    simple password store project · simple password storeJun 14, 2018

  • CVE-2018-8955
    40Plan

    The installer for BitDefender GravityZone relies on an encoded string in a filename to determine the URL for installation metadata, which al

    CriticalCVSS 9.8No exploitEPSS 4%

    bitdefender · gravityzoneOct 24, 2018

  • CVE-2018-1000076
    40Plan

    RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series

    CriticalCVSS 9.8No exploitEPSS 3%

    rubygems · rubygemsMar 13, 2018

  • CVE-2019-6318
    40Plan

    HP LaserJet Enterprise printers, HP PageWide Enterprise printers, HP LaserJet Managed printers, HP Officejet Enterprise printers have an ins

    CriticalCVSS 9.8No exploitEPSS 3%

    hp · color laserjet cm4540 mfp firmwareApr 11, 2019

  • CVE-2018-5923
    40Plan

    In HP LaserJet Enterprise, HP PageWide Enterprise, HP LaserJet Managed, and HP OfficeJet Enterprise Printers, solution application signature

    CriticalCVSS 9.8No exploitEPSS 3%

    hp · color laserjet cm4540 mfp firmwareMar 27, 2019

  • CVE-2021-37927
    40Plan

    Zoho ManageEngine ADManager Plus version 7110 and prior allows account takeover via SSO.

    CriticalCVSS 9.8No exploitEPSS 2%

    zohocorp · manageengine admanager plusSep 22, 2021

All vulnerability classes